Security Risk - Revision history

Tom: /* Context */

2024-04-12T01:28:24Z

‎Context

Tom: /* Reference */

2021-08-09T15:10:10Z

‎Reference

Tom: /* Context */

2021-03-25T15:03:53Z

‎Context

Tom: Created page with "==Full Title== For Identity Management this is the measure of the risk created by exposing protected information and access on the web. ==Context== Risk Management consis..."

2021-03-25T15:03:05Z

Created page with "==Full Title== For Identity Management this is the measure of the risk created by exposing protected information and access on the web. ==Context== Risk Management consis..."

New page

==Full Title==
For [[Identity Management]] this is the measure of the risk created by exposing protected information and access on the web.

==Context==
Risk Management consiste of risk evaluation based on assets that need protection. In any transaction there are at least two points of view, that of each party to the transaction, For identity risk management we will be addressing the POV of the user and of the web site, also known (in the GDPR) as the [[Principal]] and the [[PII Controller]].
* [[Threat Model]] provides the core data needed for [[Security Risk]] evaluation.

==Cost==
* The Risk is typically measured by the likelihood of a breach times the cost of the breach.
* An alternate measure is to look at similar enterprises and measure the cost of breaches in those simply situations.
* Banking has in many ways the easiest measures as there is a history of losses by a range of categories so a measure of risk is actually fairly easy to gage, at least for old techniques. Even for new techniques the historical data can help to create a risk metric. For example [https://www.cl.cam.ac.uk/~rja14/Papers/cost_of_cybercrime.pdf Ross Anderson and his grad students have created] an extensive inventory of cybercrime costs.

==Reference==

[[Category:Glossary]]
[[Category:Trust]]
[[Category:Assurance]]
[[Category:Security]]

← Older revision		Revision as of 15:10, 9 August 2021
Line 17:		Line 17:
	[[Category:Assurance]]		[[Category:Assurance]]
	[[Category:Security]]		[[Category:Security]]
		+	[[Category:Vulnerability]]
		+	[[Category:Risk]]

@@ Line 5: / Line 5: @@
 [[Risk Management]] consists of risk evaluation based on assets that need protection. In any transaction there are at least two points of view, that of each party to the transaction, For identity risk management we will be addressing the POV of the user and of the web site, also known (in the GDPR) as the [[Principal]] and the [[PII Controller]].
 * [[Threat Model]] provides the core data needed for  [[Security Risk]] evaluation.
 ==Cost==